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AQ 9I (Rev. 11/11) Criminal Complaint 


UNITED STATES DISTRICT COURT 


for the 
Southern District of Florida 


United States of America 
Vv, 
Case No. 


Brandon Fleury, /4 -8028-SNOW 


N ee ae ee ee NS 


Defendant(s) 


CRIMINAL COMPLAINT 


1, the complainant in this case, state that the following is true to the best of my knowledge and belief. 
On or about the date(s) of December 25, 2018 - January 11,2019 inthe county of Broward in the 
Southem District of Florida , the defendant(s) violated: 








Code Section Offense Description 


16 U.S.C. 878(c) Transmitting in interstate commerce a communication containing a threat to 
kidnap a person; 


18 U.S.C, 2261A(2)(B) With the intent to harass and intimidate another person, using an interactive 
computer service and electronic communication system of interstate 
commerce to engage in a course of conduct that caused, attempted to cause, 
or would be reasonably expected to cause substantial emotional distress to 
that person. 


This criminal complaint is based on these facts: 
See attached Affidavit. 


© Continued on the attached sheet. 


Complainant's signature 


Cameron McDowell, Special Agent, FBI 
Printed name and title 


Swom to before me and signed in my presence. 


Date: hrelia ie 7 


City and state: Fort Lauderdale, Florida Lurana S. Snow, United States Magistrate Judge 
Printed name and title 





Judge's signature 


NN  __— OOOO” SOO ane 
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AFFIDAVIT IN SUPPORT OF CRIMINAL COMPLAINT 


I, Cameron McDowell, being duly sworn, declare and state as follows: 
I. INTRODUCTION 
e I am a Special Agent (SA) with the Federal Bureau of Investigation (FBI), 


currently assigned to the Violent Crimes and Fugitive Task Force of the FBI’s Miami Division. 
My duties involve the investigation of a variety of federal offenses, including bank robberies, 
Hobbs Act robberies, extortion, interstate threats and other violations of federal law. I was hired 
by the FBI in May of 2017 and have been assigned to the Miami Division since October 2017. 


II. PURPOSE OF AFFIDAVIT 





2: This Affidavit is submitted in support of a criminal complaint charging 
BRANDON FLEURY (FLEURY) with violations of Title 18, United States Code, Sections 
875(c) (threats in interstate communications) and 2261A(2)(B) (cyberstalking). Based on the 
facts set forth below, I respectfully submit that there is probable cause to believe that, on or 
about December 25, 2018, FLEURY did transmit in interstate commerce a communication 
containing a threat to kidnap a person, in violation of Title 18, United States Code, Section 
875(c). I also submit that there is probable cause to believe that, between on or about December 
22, 2018, and January 11, 2019, FLEURY did, with the intent to harass and intimidate another 
person, use an interactive computer service and electronic communication system of interstate 
commerce to engage in a course of conduct that caused, attempted to cause, or would be 
reasonably expected to cause substantial emotional distress to that person, in violation of Title 
18, United States Code, Section 2261A(2)(B). 

3. The statements contained in this Affidavit are based on my personal knowledge, 
as well as information relayed to me by other law enforcement officials in this investigation. I 
have not included in this Affidavit each and every fact known to me. Rather, I have included 


only the facts that are necessary to establish probable cause, 
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HI. SUMMARY OF PROBABLE CAUSE 


4, Between on or about December 22, 2018, and January 11, 2019, FLEURY made a 
series of threatening and harassing posts through the social media application Instagram.' These 
messages all “mentioned” Instagram accounts used by relatives and friends of students who were 
killed in the mass shooting at Marjory Stoneman Douglas High School (MSD), in Parkland, 
Florida, on February 14, 2018 (“the MSD shooting”). Because the posts “mentioned” the 
Instagram accounts of these relatives and friends, they received notifications, including the 
contents of the messages, when they accessed their Instagram accounts. One post threatened to 
kidnap the message recipients, while others sought to harass the recipients by repeatedly taunting 
the relatives and friends of the MSD victims, cheering the deaths of their loved ones and, among 
other things, asking them to cry. 

5. While the posts were made through several different Instagram accounts and 
usernames, records for at least five of the accounts? show that they were all using the same IP 
address, which was assigned to an address in Santa Ana, California (the Santa Ana address) at 


the time of relevant posts. FLEURY resides at the Santa Ana address with his father and brother. 


"Instagram owns and operates a free-access social-networking website of the same name that can 
be accessed at http://www. instagram.com. Users can access Instagram through the Instagram 
website or by using a special electronic application (“app”) created by the company that allows 
users to access the service through an electronic mobile device. Upon creating an Instagram 
account, an Instagram user must create a unique Instagram username and an account password. 
Instagram allows its users to create their own profile pages, post photos, post comments on other 
users’ photos, and send direct messages to other Instagram users. 


2 According to Instagram’s website, one Instagram user can “mention” another Instagram 
user in a comment or post by typing the “@” symbol, followed immediately by the other user’s 
username. When one user “mentions” another, the “mentioned” user receives a notification in 
their Activity feed, which will show the comment or post. See 
https://help.instagram.com/627963287377328/?helpref=he_fnav&bc[0]=368390626577968&be 


[1]=898918476885209&be[2]=1771676186445020 (last accessed January 10, 2019). 


? The similar substance of the relevant posts, including repeated use of the same language 
and emojis, indicates that the posts came from the same individual, regardless of the fact that he 
is using multiple different Instagram accounts and usernames. Because F leury continually 
changed accounts and usernames, the government has not yet obtained IP address records for 
every account and username described herein. However, all of the accounts for which the 
government has obtained records have reflected the same IP address. 
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6. FBI agents and other law enforcement officers obtained and executed a search 
warrant on the Santa Ana address. During execution of the search warrant, the executing officers 
identified FLEURY as the subject who made the online threats. FLEURY provided a post- 
Miranda statement admitting to creating at least some of the Instagram profiles and posting the 
messages in an attempt to taunt or “troll” the victims and gain popularity. FLEURY admitted to 
targeting family members who were “activists” who had a large social media presence. FLEURY 
admitted to creating multiple Instagram profiles because he knew his comments would result in 
the profiles being reported to, and removed by, Instagram. 


IV. STATEMENT OF PROBABLE CAUSE 





A. Friends and Family of the MSD Shooting Receive Harassing and 
Threatening Messages in December 2018 and January 2019 


9, Between December 22, 2018 and up to January 11, 2019, friends and family of 
the MSD shooting received harassing and threatening messages (via posts in which they were 
“mentioned”) on Instagram from various Instagram handles. Those Instagram messages traced 
back to the same IP address. 

December 22, 2018 Messages 

10. On or about December 22, 2018, several individuals, who are siblings, friends, 
and parents of victims of the MSD shooting, filed a harassment and threating communication 
report with the Broward County Sheriff's Office (BSO), in Broward County, Florida. Among 
the reporting individuals were “JG,” “FG,” and “LS,” the brother, father, and best friend, 
respectively, of “Jamie,” who was killed in the MSD shooting. Another of the reporting 
individuals was “MS,” the father of another student killed in the shooting. 

The reporting individuals showed BSO screenshots of message notifications they had 
received on Instagram. The notifications showed posts made by other Instagram accounts that 
had “mentioned” the Instagram accounts of JG, LS, MS, and others, as well as another Instagram 


username that contained the name of (but did not actually belong to) FG. As described below, 
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the reporting individuals continued to receive similar notifications at least up to and through 
January 11, 2019, screenshots of which they similarly provided to law enforcement. 

11. On or about December 22, 2018, from approximately 3:00 a.m. - 4:11 a.m. (EST) 
the victims were mentioned in posts made by Instagram username “nikolas.killed.your.sister.” 
Notably, Nikolas Cruz is the name of the admitted perpetrator of the MSD shooting; he is 
currently in law enforcement custody in Broward County, Florida. The posts from 
“nikolas.killed.your.sister” that “mentioned” JG included the following messages (among others) 


in quick succession: 


a, “I killed your loved ones hahaha” 

b. “Cry for me” 

c: “Your grief is my joy” 

d. “With the power of my AR-15, I erased their existence.” This message 


was followed by smiling, applause, and handgun emojis.* 

é. “I gave them no mercy” 

f. “They had their whole lives ahead of them and I fucking stole it from 
them.” This message was followed by three “crying while laughing” emojis and the words 
“hahaha.” 

g. “I took Jaime away from you.” This message was followed by a string of 
“blowing a kiss” emojis. 

h. “I took Jaime away from you. You’ll never see her again hahaha.” 

i. “I took a shit on your sister’s grave.” This message was followed by a 
“crying while laughing” emoji, an applause emoji, and three “poop” emojis. 

12. Other posts by “nikolas.killed.your.sister” that were directed at LS included: 

a. “I killed your friends, baby girl” 

b. “Pm a murderer” 


4 Emojis are small pictures or symbols used in text messaging or posts on social media to 
convey emotions or represent things or ideas. 
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©. “Did you like my Valentines gift? I killed your friends.” 

13. JG’s Instagram account also received a direct message from 
“nikolas.killed.your.sister,” which read: “I killed your sister. It was fun[.] She had her whole life 
ahead of her and I fucking stole it from her. Hahaha[.] Wanna beat my ass? Come on, [JG’s first 
name]. How fucking bad do you wanna beat the shit out of me? Want me to get the death 
penalty?” 

14. According to records provided by Instagram in response to a subpoena, the person 
using the account with username “nikolas.killed.your.sister” provided Instagram with the name 
“Nikolas Jacob Cruz” and an email address of nikolastheshooter@gmail.com. The records also 
show that, at the time of the posts described above, on December 22, 2018, the account was 
accessed from IP address 68.5.103.67 (“the 67 IP address”). 

15. During his post-Miranda statement on January 16, 2019, FLEURY admitted to 
using the “nikolas.killed.your.sister” Instagram username. 

December 24, 2018 Messages 

16. | On or about December 24, 2018, from approximately 9:40 p.m.-9:50 p.m. (EST), 
JG and LS were “mentioned” in Instagram posts by another Instagram username, 
“bullseyetauntsyou_.” The posts included: 

a. “Yoo-hoo! Nikolas took Jaime away from you so cry for me plz.” This 
message was followed by smiling face and applause emojis. 
b. “You'll never see Jaime again, little orphan. Nikolas took her from you.” 

17. During his post-Miranda statement, FLEURY admitted to using nicknames that 
included the name “bullseye,” a reference to a movie villain. 

18. Also on December 24, 2018, from approximately 9:45 p.m. - 11:13 p.m. (EST), 
JG and LS were “mentioned” in posts made by another Instagram username “angie.and.lola.” 
The posts included the following messages (among others) within the span of approximately 20 
minutes: 


a. “How’s Jamie, hun?” 


Page 5 of 12 


Case 0:19-mj-06026-LSS Document1 Entered on FLSD Docket 01/18/2019 Page 7 of 13 


b. “Dead huh?” 

C. “Nikolas took your loved ones away from you, doll” 

d. “Nikolas stole Jaime’s future, boo” 

€ “Eat the poop for Jaime hun” (followed by four “poop” emojis). 

f. “Eat the poop for Jaime” (followed by several “poop” emojis). 

g. “Eat some poop for Jaime this holiday season” (followed by several poop 


emojis). 

19. The name associated with the “angie.and.lola” account in Instagram’s records is 
“Angie & Lola.” Those records also show that the account was opened with, and used, the 67 IP 
address. 

20. Continuing on or about December 24, 2018, from approximately 10:00 p.m. - 
10:05 p.m. (EST), JG and LS continued receiving notifications of additional messages posted by 
Instagram name “nik.taunts_.” The posts included the following (among others): 

a. “I killed Jaime, fool.” This message was followed by “crying while 
laughing,” smiling, and handgun emojis. 
b. “I stole your sister’s future, buddy, With the power of my AR-15” 


(followed by smiling, handgun, and applause emojis). 


c. “I killed Jaime hahaha” and 
d. “Pm her murderer.” 
21. According to records subpoenaed from Instagram, the name associated with the 


“nik.taunts_” account in Instagram’s records is “Nikolas.” However, those records show that, at 


the time of the messages described above, the account was being accessed by the 67 IP address. 


December 25, 2018 Messages 
22 On or about December 25, 2018, from approximately 7:59 p.m. - 8:02 p.m. (EST), 


JG and LS were mentioned in more posts from Instagram username “teddykillspeople.” These 


posts included; 
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a. “T'm your abductor [smile and applauding emojis] I’m kidnapping you 
fool” (followed by two emojis showing a lock, as well as applauding and “blowing a kiss” 
emojis). 

b. “I killed Janice Ott and Denise Naslund.” 

23. Notably, Janice Ott and Denise Naslund were abducted and murdered by serial 
killer Ted Bundy in 1974. Although FLEURY initially stated he did not recall using the 
“teddykillspeople” username, during his interview he admitted to having a strong interest in Ted 
Bundy and having researched him. 

24. Continuing on or about December 25, 2018 from approximately 9:21 p.m. - 9:23 
p.m., JG and LS were “mentioned” in Instagram posts from username “tedtheabductor.” The 
posts included: 

a. “Nikolas murdered your friends and teachers but guess what? I murdered 
Janice Ott and Denise Naslund.” 

b. “I kidnapped them and killed them both on July 14, 1974.” 

25. Based on the threat to kidnap in the posts from “teddykillspeople,” Instagram 
voluntarily provided the IP address used by that account on an emergency basis to law 
enforcement. Instagram identified the 67 IP address as the IP address used by that account at the 
time of the threats. 

December 31, 2018 Messages 

26. On or about December 31, 2018, at approximately 12:37 a.m. (EST) JG was 
mentioned in posts by Instagram username “nikolasthemurderer.” The posts included: 

a. “I took away Jaime’s future”; and 

b. “Little [AS] will never play music again.” This message was followed by 
smiling, applauding, and handgun emojis. This message also mentioned “MS,” whose son, 


“AS,” was also killed in the MSD shooting. 
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January 9, 2019 Messages 
27. On or about January 9, 2019, between approximately 12:00 - 2:00 a.m. (EST), JG, 


LS, and others were “mentioned” in additional posts by the “nik.taunts_” username and 


Instagram username “bullseyeteaseshisvictims.” The posts included: 


a. “WHOO!! I killed Jaime and Scott Beigel hehehaha” 

b. “I shoot through the window” 

c. “with my AR-15” 

d. “Hey orphan” 

e. “Nikolas took Scott away from you and his family” and 
f. “hey you! I killed Scott Beigel! Hahaha!” “Hey orphan.” 


28. Continuing on or about January 9, 2019, between approximately 8:13 p.m. and 
9:00 p.m., JG and others were mentioned in posts by Instagram username “the.douglas.shooter.” 
The posts included (among others): 
a. “T killed Scott Beigel I shot him dead” 
b. “T enjoyed it too” 


Ç. “With the power of my AR-15, you all die” 


d. “I’m a murderer. It’s what I do, fool” 

€ “I’m a murderer. Hahahaha!” 

f. “I killed Scott! Hahaha! With the power of my AR-15” and 
g. “Tm a homicidal outrage, mother***ers!” 


January 10 — 11, 2019 Messages 


29, On or about January 10, 2019, JG and others were mentioned in additional posts 


by the “nikolas.the.murderer_” username. 


> Scott Beigel was a teacher killed during the MSD shooting. When asked during his 
interview if he could name some of the MSD shooting victims, FLEURY first named Scott 
Beigel. 
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30. On or about January 11, 2019, from approximately 5:58 a.m. — 6:23 a.m. (EST), 
JG and others were mentioned in posts from Instagram username “dani.dont.give.two.fucks.” 
These posts included (among others): 
a. “Nikolas killed your loved ones huh?” 
b. “Nikolas killed Scott Beigel in cold blood.” This message was followed 
by three “crying while laughing” emojis. 
C: “Hehehaha! Mr. Beigel is dead!” and 
d. “I taunt you.” 
31. Continuing on or about January 11, 2019, from approximately 6:26 a.m. — 6:29 
a.m. (EST), JS and others were mentioned in posts from Instagram username 


“bullseye.taunts.and.teases.” These posts included (among others): 


a. “Hahaha, hey orphan!” 
b. “Come at me little orphan! I killed your father!” and 
C “Yoo-hoo!! Orphan! Let’s play!” 


32. | Continuing on or about January 11, 2019, between approximately 5:58 a.m. and 
6:23 a.m. (EST), JG and others were mentioned in additional posts from Instagram username 
the.douglas.shooter. These included (among others): 

a. “With the power of my AR-15, I take your loved ones away from you 
PERMANENTLY” and 
b. “Hahaha! I’m the Douglas shooter! SCREAM!!” 

33. As a result of the threat of murder, Instagram voluntarily identified the IP address 
related to username “the.douglas.schooter” to law enforcement. The IP address used by this 
username was the 67 IP address. 

34. On or about January 4, 2019, Detective Mealer of BSO and I interviewed JG, FG, 
LS, and MS. These individuals advised they received notifications via Instagram of the posts in 
which they were mentioned described above. All the victims viewed the posts and 


acknowledged they caused emotional distress. Specifically, the post made on December 25, 
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2018, by “teddykillspeople,” which stated “I’m your abductor I’m kidnapping you fool” placed 
JG, FG, LS, and MS in fear. On or about January 10, 2019, the Affiant spoke again with FG, 
who indicated that both he and JG remain in fear from the kidnapping threat and are afraid to 
respond to the repeated messages. 


B. The IP Addresses Associated with the Harassing Instagram Posts Traces 
Back to the Santa Ana Address 


35. A query of the 67 IP address revealed it was serviced by Cox Communications. 
Cox Communications informed law enforcement that this IP address was assigned to the 
subscriber account of PT located at the Santa Ana 
address, from October 8, 2017, through December 27, 2018.° According to queries of the law 
enforcement database CLEAR, the Santa Ana address is associated with FLEURY, his father, 
and his brother. 

36. Law enforcement also conducted a check of the Wi-Fi signals accessible from the 
street outside the Santa Ana address. Four different Wi-Fi connections appeared. Law 
enforcement attempted to access all four Wi-Fi connections but discovered they were all 
password-protected and inaccessible without the password. Based on my training and 
experience, the fact that the Santa Ana address’s Wi-Fi is not public means that it is unlikely that 
an individual not living in the address would have the 67 IP address. 

C. Execution of the Search Warrant 

37. On January 11, 2018, U.S. Magistrate Judge Edward Infante, of the Central 
District of California, signed a Search Warrant for the Santa Ana address, under Case Number 
8:18-MJ-00022. 

38. On January 16, 2018, at approximately 6:00 a.m. (PST), FBI agents and other law 
enforcement officers executed the Search Warrant at the Santa Ana address. Upon execution, 


they found FLEURY, his father, and his brother in the home. FLEURY made spontaneous 


° Law enforcement requested this information prior to the posts made on December 31, 
2018 and January 9-11, 2019. A request to Cox for information on the assignment of the 67 IP 
address on these later dates is currently pending. 
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statements to the effect that the agents were there because of “some stupid shit” he had done on 
the Internet. 

39. Based on these statements and subsequent statements during his post-Miranda 
interview, law enforcement identified FLEURY as the subject who made the online threats. 
FLEURY admitted to creating multiple Instagram profiles, including using variations on 
nikolastheshooter and nikolas, the.douglas.shooter, and bullseye. FLEURY described his 
“fascination” with Nikolas Cruz, other mass shooters, Ted Bundy, and other serial killers. He 
further admitted to posting the messages in an attempt to “troll” the victims, trying to “get 
reactions” from people and be controversial. FLEURY stated he was motivated by gaining 
popularity and notoriety after posting the messages. FLEURY admitted to targeting shooting 
victim’s family members who were “activists” and who had large who had large social media 
presences. FLEURY admitted to creating multiple Instagram profiles because he knew his 
comments would result in the profiles being reported and removed. FLEURY did not show 
remorse for posting the comments but explained he would not follow through on the threats he 
communicated. He claimed that his messages were not threats, but were “more like taunts.” 
However, when asked whether he could see why a messages like “I am your abductor” and “I am 
kidnapping you, fool” would feel threatening to the message recipients, FLEURY responded, “I 
guess so.” He also explained that he established multiple Instagram accounts, anticipating that 
Instagram would shut down at least some of those accounts based on complaints about his 
messages. 

40, | FLEURY further admitted to using his tablet to author the taunting messages. The 
tablet was collected as evidence.’ 

V. CONCLUSION 
41. Based on the foregoing facts, I respectfully submit that there is probable cause to 


believe that, on or about December 25, 2018, FLEURY did transmit in interstate commerce a 


7 A search of this tablet, and other electronic devices found in the Santa Ana address, 
pursuant to the search warrant, is ongoing. 
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communication containing a threat to kidnap a person, in violation of Title 18, United States 
Cade, Section 875(c), I also submit that there is probable cause to believe that, between on or 
about December 22, 2018, and January 11, 2019, FLEURY did, with the intent to harass and 
intimidate another person, use an interactive computer service and electronic communication 
system of interstate commerce to engage in a course of conduct that caused, attempted to cause, 
or would be reasonably expected to cause substantial emotional distress to that person, in 


violation of Title 18, United States Code, Section 2261A(2)(B). 


Cameron ae 


Special Agent 
Federal Bureau of Investigation 


Sworn to and subscribed before me 
this day of January, 2019. 


è 
NA S. SNOW 
UNITED STATES MAGISTRATE JUDGE 
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